{"data":{"slug":"kyverno","name":"Kyverno","tagline":"Apache-2.0 CNCF Kubernetes policy engine — policies as YAML, not Rego","category":"devops","categoryName":"DevOps","url":"https://kyverno.io","github":"https://github.com/kyverno/kyverno","pricing":"open-source","hook":"Kyverno is a Kubernetes-native policy engine: validate, mutate, generate, and clean up resources, and verify image signatures, with policies written as Kubernetes YAML instead of a separate policy language.","whatsGood":"Apache-2.0, CNCF project (kyverno/kyverno), v1.19.1. Runs as an admission controller plus background scans and policy reports; CLI for testing policies in CI; large community policy library. Image verification pairs with Sigstore signing — the cosign gem already names Kyverno as its admission-control partner. ★~8.2k.","theCatch":"Enforces at admission time, so a bad policy (or an unavailable webhook with fail-closed settings) can block deploys cluster-wide — roll out in audit mode first. YAML policies get awkward for complex logic; Rego-based engines express that more cleanly. Vs kubescape (posture and compliance scanning) and topaz (application authorization): Kyverno is the in-cluster admission policy lane.","verdict":"Apache-2.0 Kubernetes admission policy engine when policies should be plain YAML — start in audit mode; reach for Rego when logic gets complex.","addedAt":"2026-10-09","featured":false,"domain":"DevOps","subSpecialty":"Security","subcategory":"Security","tags":["self-host","permissive","kubernetes","active"],"capabilities":["kubernetes","policy","admission"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Apache-2.0","githubStars":8262,"starsPerWeek":21,"access":"free","archived":false,"repo":{"createdAt":"2019-02-04","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"github-actions","name":"GitHub Actions","tagline":"CI/CD that lives where your code does"},{"slug":"docker","name":"Docker","tagline":"Container runtime that changed deployment"},{"slug":"kubernetes","name":"Kubernetes","tagline":"Container orchestration at scale"},{"slug":"pulumi","name":"Pulumi","tagline":"Infrastructure as code in real languages"},{"slug":"fly-io","name":"Fly.io","tagline":"Deploy apps to VMs close to your users"}],"links":{"self":"/api/gems/kyverno","html":"/gems/kyverno","markdown":"/gems/kyverno.md","category":"/api/gems?category=devops","categoryPage":"/stacks/devops"}}